patchlisted

Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, or an execution-harness results directory. Static-analysis input gets a per-finding patch subagent + an independent reviewer and is written as inert diffs for human review; results-directory input from an external execution harness (the defending-code reference pipeline, if installed) is delegated to its verified build→reproduce→regress→re-attack patch ladder. Writes PATCHES/bug_NN/{patch.diff,patch_result.json}, PATCHES.md, and PATCHES.json. Use when asked to "fix the findings", "patch these vulns", "generate fixes", or "close the loop on triage".
air-gapped/skills · ★ 3 · AI & Automation · score 79

Install: claude install-skill air-gapped/skills

# patch Third leg of the static pipeline (`/vuln-scan` → `/triage` → `/patch`). Turns a ranked list of verified findings into candidate diffs. The skill **never applies a diff** to the target repo. Output is inert text in `./PATCHES/` for a human to review and apply out-of-band — see § "Reviewing generated patches" at the end of this file. There is no `--apply` or `--approve` flag by design: the capability isn't present, so it can't be prompt-injected into use. Invoke with `/patch <findings-path> [--repo PATH] [--top N] [--id fNNN] [--model M] [--fresh]`. **Arguments** (parse from `$ARGUMENTS`): - findings path (first positional, required): `TRIAGE.json`, `VULN-FINDINGS.json`, a pipeline `results/<target>/<ts>/` directory, or any JSON the `/triage` ingest table recognizes. - `--repo PATH`: target codebase, read-only (default cwd). Required for static mode; the skill stops if cited files don't resolve under it. - `--top N`: patch only the N highest-severity true positives (static mode). - `--id fNNN`: patch only the finding with this id. - `--model M`: passed through to `vuln-pipeline patch` in execution-verified mode. Ignored in static mode (subagents inherit the orchestrator's model). - `--fresh`: ignore `./.patch-state/` checkpoint and start over. **Tools.** Prefer Read, Glob, Grep, Write, Task. Some sessions do not provision Glob or Grep; `allowed-tools` is a permission filter, not a loader. When they are unavailable, fall back to the read-only Bash commands w